HarmonyOS CVE-2026-101180

Exploitation requires the victim to open or process an attacker-supplied malformed file with the HarmonyOS file parsing module (UI:R), which triggers uncontrolled recursion (CWE-674) and exhausts resources. This user-interaction requirement is the primary limiting factor - there is no remote, interaction-free path. No authentication is required (PR:N), and no special non-default configuration is indicated in the available sources; however, the exact file formats or parsing entry points that trigger the recursion are not described in the available sources. Impact is limited to availability (temporary crash of the parsing component, A:L), with no confidentiality or integrity effect.

This is a moderate-severity denial-of-service issue (CVSS 4.3) in HarmonyOS's file parsing module, classified as CWE-674 (Uncontrolled Recursion). The signals are internally consistent and point to a genuinely bounded risk rather than a top priority: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) shows only low availability impact with no confidentiality or integrity effect, and crucially requires user interaction (UI:R), which breaks any fully automated or wormable exploitation. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not 'act_now' or 'emergency' - which aligns with the low impact. No EPSS score, no CISA KEV listing, and no public exploit reference are provided in the input, so there is no evidence of active exploitation or available exploit code. Note one conflict in the metadata worth flagging: the CVE is tagged 'Information Disclosure', but the CVSS vector sets C:N/I:N with only A:L and the CWE is a resource-exhaustion class - this is purely an availability/DoS issue, not disclosure, so the tag appears mislabeled and should not drive triage.

An attacker crafts a malformed file that triggers uncontrolled recursion in the HarmonyOS file parsing module and delivers it to a victim (e.g., via message, download, or shared storage). When the user opens or otherwise processes the file, the deeply nested or self-referential structure exhausts stack/resources and crashes the parsing component, causing a temporary denial of service. No public exploit code is identified at time of analysis, and the attack cannot proceed without the victim opening the file (UI:R).